{"id":"CVE-2026-62099","published":"2026-10-10T20:16:43.580","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/kute-boutique/vulnerability/wordpress-boutique-theme-2-3-3-local-file-inclusion-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A local file inclusion vulnerability allows unauthenticated attackers to read arbitrary files on the server filesystem, potentially exposing sensitive data like configuration files, database credentials, or application source code.","exploitability":"Exploitation requires sending a crafted request to the vulnerable endpoint with a malicious path traversal payload, but no authentication is needed and the vulnerability affects all versions up to 2.3.3.","blast_radius":"If exploited, attackers could access sensitive files including database connection details, application secrets, and potentially gain deeper access to the underlying system through exposed configuration or source code.","remediation":"Upgrade to Boutique version 2.3.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","unauthenticated","web","file-inclusion"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:07:53.323Z"}}